4

I just noticed something weird when using the Tor Browser to access google.com.

My entry node was located in France, and the exit node was located in the Netherlands, as can be seen in the image here:

enter image description here

However Google redirected me to www.google.fr, aka the French site, which indicates to me, that it must know what the entry node was.

How can that be? As far as I understood, or is relayed in other questions on this site, e.g. here, Google should only know the exit node, right?

migrated from security.stackexchange.com Apr 19 '16 at 13:37

This question came from our site for information security professionals.

  • What language settings are you using? Might have picked up on those, if they're not being fully hidden by the browser. – Matthew Apr 19 '16 at 10:38
  • The browser is set to english, and my operating system is in german. – Jens Apr 19 '16 at 10:39
  • what happens if you use a new identity? – Jay Apr 19 '16 at 10:42
  • 2
    Why using Tor in Chrome? It says on Tor offical website (FAQ): "I want to use Chrome/IE/Opera/etc with Tor. In short, using any browser besides Tor Browser with Tor is a really bad idea." – mirsad Apr 19 '16 at 10:58
  • 2
    @mirsad I didn't use Chrome. It is the Tor Browser Bundle in the newest version. It just looks a lot like Chrome in the screenshot :) – Jens Apr 19 '16 at 11:06
6

When you use Tor, the sites you connect to only sees the IP of the exit node and not your IP or any of the IPs of the previous nodes. This is in fact the very purpose of onion routing. If Google could see that your entry node was in France, Tor would be fundamentally broken.

The happy news is that it isn't. Google does not only rely on IP but uses a variety of ways to determine your location:

How location is auto-detected

If you don't set your location, Google shows an approximate location based on the following things to help provide you with the most relevant results:

  • Your IP address.
  • Your Location History if you have it turned on.
  • Google Toolbar's My Location feature if it’s turned on.
  • Recent locations you’ve searched for.

That you got redirected to French google when using an entry node in France is just a coincidence. The last bullet point could explain why Tor users gets seemingly random locations. All users using the same exit node (and thus the same IP in Googles eyes) will be asumed to be in the same location by Google.

So probably someone had just googled for a nice bakery in Paris from the exit node you happend to be using.

  • Great explanation, I didn't think of all the other users using the node. That makes sense – Jens Apr 19 '16 at 13:02
  • This interpretation doesn't hold water. I work with Chrome set to google.com and search global .com sites almost exclusively, if I only switch to incognito mode I am immediately given Japanese results based on my IP. "Recent locations" here refers to the browser profile, not IP. Just think about it - Google was pioneering move to https - why would they reveal now what regions other users use inside their TLS sessions to a random user who happens to use the same gateway? – techraf Apr 19 '16 at 13:18
2

GeoIP targeting is not 100% accurate, it's pretty normal behaviour of any IP-to-geo location service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy